How to Configure OAuth 2.0 and API Key Authentication in BoldDesk MCP
The MCP Configuration page enables administrators to manage how external AI tools, IDEs, and applications connect to BoldDesk through the Model Context Protocol (MCP). Administrators can configure authentication methods and monitor authorized OAuth clients from a centralized location.
Accessing MCP Configuration
- Sign in to the BoldDesk Admin Portal.
- Navigate to Settings → Developer Settings → MCP Configuration.
The MCP Configuration page provides controls for authentication and OAuth client management.
Authentication Methods
The page supports two authentication methods:
OAuth 2.0 Authentication (Beta)
OAuth 2.0 is recommended for applications that require user authorization and secure, scoped access.
Use cases:
- AI assistants and copilots
- IDE extensions
- Third-party applications
- User-specific access scenarios
Benefits:
- User consent-based access
- Scoped permissions
- Token-based authentication
- Enhanced security for connected applications
API Key Authentication
API keys are intended for trusted server-side integrations and automation workloads.
Use cases:
- Backend services
- Scheduled jobs
- Service-to-service integrations
- Internal automation workflows
Best practices:
- Store API keys securely.
- Do not expose API keys in client-side applications.
- Rotate keys periodically according to your organization’s security policies.
Connected OAuth Clients
The Connected OAuth Clients section displays applications that have been authorized to access the MCP service.
For each client, administrators can view:
| Field | Description |
|---|---|
| Client Name | Name of the connected application |
| Client ID | Unique identifier assigned to the OAuth client |
| Status | Current status (Active or Revoked) |
| Created On | Date and time when the client authorization was created |
| Action | Option to revoke client access |
Revoking Client Access
Administrators can immediately revoke access granted to an OAuth client.
Steps
- Open Settings → Developer Settings → MCP Configuration.
- Locate the client in the Connected OAuth Clients list.
- Click Revoke next to the client.
- Confirm the action if prompted.
After revocation, the client will no longer be able to authenticate using its existing authorization.
Monitoring Connected Applications
Use the Connected OAuth Clients list to:
Review authorized applications.
Identify active integrations.
Remove unused or unauthorized clients.
Audit MCP access across the organization.
The client list supports searching and displays authorization status for each connected application.
Security Recommendations
- Use OAuth 2.0 for user-facing and third-party integrations.
- Use API Keys only for trusted backend services.
- Regularly review connected OAuth clients.
- Revoke access for unused integrations.
- Follow your organization’s credential management policies.
The MCP Configuration feature provides centralized management of MCP authentication and connected AI tooling, helping organizations securely control how external applications access BoldDesk resources.
